CWEweakness

CWE-703 Improper Check or Handling of Exceptional Conditions

Official page ↗
Abstraction
Pillar
Structure
Simple
Status
Incomplete
Languages
Not Language-Specific, Python
CWE version
5.0

Description

The product does not properly anticipate or handle exceptional conditions that rarely occur during normal operation of the product.

Common consequences

• Confidentiality, Availability, Integrity: Read Application Data, DoS: Crash, Exit, or Restart, Unexpected State

Detection methods

• Dynamic Analysis with Manual Results Interpretation: According to SOAR [REF-1479], the following detection techniques may be useful: Highly cost effective: • Fault Injection - source code • Fault Injection - binary Cost effective for partial coverage: • Forced Path Execution • Manual Static Analysis - Source Code: According to SOAR [REF-1479], the following detection techniques may be useful: Highly cost effective: • Manual Source Code Review (not inspections) Cost effective for partial coverage: • Focused Manual Spotcheck - Focused manual analysis of source • Automated Static Analysis - Source Code: According to SOAR [REF-1479], the following detection techniques may be useful: Cost effective for partial coverage: • Source code Weakness Analyzer • Context-configured Source Code Weakness Analyzer • Architecture or Design Review: According to SOAR [REF-1479], the following detection techniques may be useful: Highly cost effective: • Inspection (IEEE 1028 standard) (can apply to requirements, design, source code, etc.) • Formal Methods / Correct-By-Construction

Observed examples

• [REF-1374]: Chain: JavaScript-based cryptocurrency library can fall back to the insecure Math.random() function instead of reporting a failure (CWE-392), thus reducing the entropy (CWE-332) and leading to generation of non-unique cryptographic keys for Bitcoin wallets (CWE-1391) • CVE-2022-22224: Chain: an operating system does not properly process malformed Open Shortest Path First (OSPF) Type/Length/Value Identifiers (TLV) (CWE-703), which can cause the process to enter an infinite loop (CWE-835)

Related

Observed example · CVE (1)

  • CVE-2022-22224 An Improper Check or Handling of Exceptional Conditions vulnerability in the processing of a malformed OSPF TLV in Juniper Networks Junos… vulnerability

Referenced by CVE · weakness (177)

  • CVE-2026-76481 As part of Cisco's ongoing commitment to proactive security and product quality, engineering teams for Cisco Emergency Responder, Cisco… vulnerability
  • CVE-2026-76527 As part of Cisco's ongoing commitment to proactive security and product quality, Cisco has conducted a comprehensive internal security… vulnerability
  • CVE-2026-76458 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco NX-OS engineering team has conducted a… vulnerability
  • CVE-2026-32641 Parseable is a log analytics platform built for high-volume data ingestion and analysis. vulnerability
  • CVE-2026-61822 pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. vulnerability
  • CVE-2026-20329 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco Secure Adaptive Security Appliance Software,… vulnerability
  • CVE-2026-92790 Higress before 2.2.4 panics when processing a Cookie header segment without an equals sign, causing the plugin wrapper to recover and… vulnerability
  • CVE-2026-71640 An issue in ZJU-FAST-Lab EGO-Planner-v2 All versions up to commit 5c99a95880401e2599638d567abc0e240396cb42 allows unsafe vehicle motion via… vulnerability
  • CVE-2026-71645 An issue in Robotics-STAR-Lab (SYSU STAR Group) RACER Tested affected version: commit abcdef1234567890 allows an attacker to cause a denial… vulnerability
  • CVE-2026-80135 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Check… vulnerability
  • CVE-2026-57445 Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable… vulnerability
  • CVE-2026-20280 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco IOS XR Software engineering team has… vulnerability
  • CVE-2026-82417 ### Summary `qs.stringify` throws a `TypeError` when it serializes an object whose own `constructor` property has a truthy, non-callable… vulnerability
  • CVE-2026-26446 Stomper 5e2741e is vulnerable to Denial of Service. vulnerability
  • CVE-2026-65331 This issue was addressed through improved state management. vulnerability
  • CVE-2026-65332 This issue was addressed through improved state management. vulnerability
  • CVE-2026-65337 This issue was addressed through improved state management. vulnerability
  • CVE-2026-65340 This issue was addressed through improved state management. vulnerability
  • CVE-2026-65351 This issue was addressed through improved state management. vulnerability
  • CVE-2025-59322 CPSD CryptoPro Secure Disk for Bitlocker before v7.7.4 fails to properly handle decryption errors and allows encrypted volumes to be… vulnerability
  • CVE-2026-18638 Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single… vulnerability
  • CVE-2026-56818 Netty is an asynchronous, event-driven network application framework. vulnerability
  • CVE-2026-38763 An issue in Unistal Systems Pvt. vulnerability
  • CVE-2026-16218 A vulnerability was detected in hunvreus devpush up to 0.4.6. vulnerability
  • CVE-2026-20187 As part of Cisco's ongoing commitment to proactive security and product quality, the Cisco RoomOS engineering team has conducted a… vulnerability
  • CVE-2026-51600 Tenda CP3 V3.0 firmware V31.1.9.91 does not validate the Content-Length header field in RTSP requests (including DESCRIBE, SETUP, and PLAY… vulnerability
  • CVE-2026-13753 Certain HP DeskJet All-in-One printers may be potentially vulnerable to information disclosure that allows an unauthenticated attacker to… vulnerability
  • CVE-2026-56338 Capgo before 12.128.2 contains a denial of service vulnerability in the /auth/v1/otp endpoint that prevents email verification for… vulnerability
  • CVE-2026-12324 Incorrect boundary conditions in the Graphics: CanvasWebGL component. vulnerability
  • CVE-2026-44893 Netty is a network application framework for development of protocol servers and clients. vulnerability
Show all 177 ›

Referenced by CWE · child of (8)

  • CWE-1384 Improper Handling of Physical or Environmental Conditions weakness
  • CWE-228 Improper Handling of Syntactically Invalid Structure weakness
  • CWE-248 Uncaught Exception weakness
  • CWE-392 Missing Report of Error Condition weakness
  • CWE-393 Return of Wrong Status Code weakness
  • CWE-397 Declaration of Throws for Generic Exception weakness
  • CWE-754 Improper Check for Unusual or Exceptional Conditions weakness
  • CWE-755 Improper Handling of Exceptional Conditions weakness

Referenced by CWE · has member (2)

  • CWE-1000 Complete Weakness Hierarchy view
  • CWE-1340 CISQ Data Protection Measures view

Referenced by OWASP · mapped cwe (1)

  • A10:2025 Mishandling of Exceptional Conditions Top 10 2025